fnotifystat - a tool to show file system activity
fnotifystat is a program that dumps the file system activity in a given period
Statistics are output every 'delay' seconds. One can use the 'm' (minutes), 'h'
(hours), 'd' (days), 'w' (weeks) or 'y' (years) suffix to specify large delay
intervals. By default the delay is 1 second.
Statistics are ouput 'count' many times before exiting. If count is not
specified then fnotifystat will run until it is stopped.
Note that if no file activity has occured during a sample delay period then no
new statistics are output. The -f option will force output if desired.
By default, fnotifystat will display the following statistics every sample
- Average number of opens, closes, reads and writes over the
- Average number of opens over the sample period
- Average number of closes over the sample period
- Average number of reads over the sample period
- Average number of writes over the sample period
- Process ID
- The -I option will display the device (major, minor) number
and inode instead of the filename while the -I option will just show the
device (major, minor) number.
- The -c option will display the cumulative count of the
open, close, read and writes rather than the averages.
fnotifystat options are as follow:
- dump cumulative totals over all time rather than totals
over each sample period.
- strip full directory path off the filenames.
- force statistics output even if no file activity has
occurred during the last sampling period.
- order statistics by unique device. Rather than ordering
periodic statistics by unique filename, instead order them by unique
device (major, minor) number. This allows one to see file activity on a
per device basis.
- show help
- pathnames to include in filename activity. By default, all
mounted filesystems are monitored, however, this may produce to much
information. The -i option allows one to provide a comma separated list of
just the specific paths to monitor.
- order statistics by unique device and inode. Rather than
ordering periodic statistics by unique filename, instead order them by
unique device (major, minor) and inode number.
- merge events. The default -v verbose output will show all
new events that fnotifystat detects on a file by a specific process. The
-m option will merge all consecutive events that occur on the same file
from the same process to reduce the amount of event output.
- no periodic statistics, just verbose mode only. Do not
display periodic file activity statistics, but just show the verbose mode
-v file activity.
- -p proclist
- monitor specific processes. proclist is a comma separated
list of process IDs or process names to monitor.
- sort stats by pid first, then by totals and filename
- turn off data scaling. By default the read, write, open and
close counts are displayed by scaling by multiple of thousands with
suffixes of K (thousands), M (millions), B (billions). The -s option
disables this, resulting in less aesthetically pleasing unaligned columns
- -t N
- only display the top busiest N files.
- show timestamp
- verbose mode, dump all file activity. This will display the
following file access information:
|Date (in DD/MM/YY format)
|Time (in HH:MM:SS format)
|Access type, O=Open, C=Close, R=Read, W=Write
|Name of accessed file
Note that the names of deleted filenames cannot be determined and are
flagged by the "(deleted)" tag.
- pathnames to exclude from filename activity. By default,
all mounted filesystems are monitored, however, this may produce to much
information. The -x option allows one to provide a comma separated list of
pathnames to exclude. Matching is performed on partial pathnames, for
example -x /pro will exclude all paths starting with /pro, such as /proc.
Note that excluding a file with -x takes higher precedence over including
a file with -i.
- Sending SIGUSR1 to fnotifystat will toggle the verbose
option (-v) on/off.
Show file activity every second until stopped.
Show the top 10 active files every 60 seconds until stopped.
sudo fnotifystat -t 10 60
Show file acivity every 10 seconds just 6 times.
sudo fnotifystat 10 6
Show file activity of thunderbird and process ID 1827.
sudo fnotifystat -p thunderbird,1827
Show every file notify event and the top 20 active activity files over a single
period of 5 minutes.
sudo notifystat -v -d -c 5m 1
Just show every file notify event on /sys and /proc and no periodic statisics.
sudo fnotifystat -n -i /sys,/proc
fnotifystat was written by Colin King <email@example.com>
This manual page was written by Colin King <firstname.lastname@example.org>, for
the Ubuntu project (but may be used by others).
Copyright © 2014-2017 Canonical Ltd.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR